Sub-Processor List
Version: subprocessors-2026-10
Effective date: 2026-10-19
Applies to: ATHELOS Cloud and ATHELOS Dedicated
This is the authoritative list of sub-processors engaged by ZERODIN to process customer data as part of the ATHELOS service. It is the annex referenced by the Data Processing Agreement (DPA).
Under GDPR Article 28(2), ZERODIN may not engage a sub-processor without prior specific or general written authorization from the customer. This list is the general authorization.
1. Authorized sub-processors
1.1 Hetzner Online GmbH
| Field | Value |
|---|---|
| Legal entity | Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany |
| Purpose | Compute — hosts the ATHELOS application, per-tenant Postgres databases, MinIO object storage, and Meilisearch indices |
| Data categories | All customer data (tenant business data, control-plane data) |
| Location | EU — Nuremberg (nbg1), Falkenstein (fsn1), Helsinki (hel1) |
| Safeguards | Intra-EU transfer — no SCCs needed. GDPR-compliant DPA with Hetzner. Encryption at rest (LUKS) and in transit (TLS 1.3). |
Scope:
- Dedicated: One Hetzner VPS per customer. All tenant data lives on the customer's own VPS.
- Cloud: Shared Hetzner infrastructure. Tenant data is database-per-tenant isolated.
1.2 Backblaze, Inc.
| Field | Value |
|---|---|
| Legal entity | Backblaze, Inc., 201 Baldwin Ave, San Mateo, CA 94401, USA |
| Purpose | Offsite backup storage via restic — encrypted snapshots of Postgres, MinIO, Meilisearch |
| Data categories | Encrypted backup snapshots (customer data at rest, encrypted client-side before upload) |
| Location | USA (default B2 region) |
| Safeguards | EU → US transfer requires SCCs. restic encrypts snapshots client-side before upload, so Backblaze never sees plaintext data. DPA with Backblaze on request. |
Repository layout:
- Dedicated:
b2:athelos-dedicated:/<customer-id>/— one shared bucket, one repo per customer - Cloud:
b2:athelos-cloud:/<tenant-id>/— one shared bucket, one repo per tenant
Per-customer encryption: Each restic repository has its own RESTIC_PASSWORD (write-once, per-instance). Cross-customer data leakage is impossible even within the same B2 bucket.
1.3 Cloudflare, Inc.
| Field | Value |
|---|---|
| Legal entity | Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA |
| Purpose | DNS — A records for <tenant>.athelos.pro subdomains and the athelos.pro marketing domain |
| Data categories | DNS records only. No customer business data, no PII beyond the subdomain slug (which is chosen by the customer). |
| Location | Global anycast edge; configuration data stored in Cloudflare's global network (US primary) |
| Safeguards | SCCs with Cloudflare. API tokens scoped to Zone.DNS:Edit on athelos.pro only. DNS records set to proxied: false (Grey Cloud), so customer traffic does not pass through Cloudflare's edge — only DNS resolution does. |
1.4 Stripe, Inc. / Stripe Payments Europe, Ltd.
| Field | Value |
|---|---|
| Legal entity (EU) | Stripe Payments Europe, Ltd., The One Building, 1 Lower Grand Street, Dublin 2, Ireland |
| Legal entity (non-EU) | Stripe, Inc., 510 Townsend St, San Francisco, CA 94103, USA |
| Purpose | Subscription billing — Checkout, subscription management, invoicing, payment method storage |
| Data categories | Customer email, company name, billing address, payment method (card). Payment card data never touches ATHELOS servers. |
| Location | EU (Ireland) for EU customers; USA for non-EU customers |
| Safeguards | Stripe is PCI-DSS Level 1 certified. Intra-EU for EU customers — no SCCs needed. DPA with Stripe available in the Stripe Dashboard. |
PCI note: ATHELOS never stores, processes, or transmits payment card data. All card entry happens on Stripe-hosted pages.
1.5 ActiveCampaign, LLC (Postmark)
| Field | Value |
|---|---|
| Legal entity | ActiveCampaign, LLC, 1 N Dearborn St, 5th Floor, Chicago, IL 60602, USA (operating the Postmark product) |
| Purpose | Transactional email — signup verification, password reset, operator notifications |
| Data categories | Recipient email address, email subject, email body (which may contain tenant slug and a verification token URL), delivery metadata (timestamp, delivery status, bounce events) |
| Location | USA — Postmark does not maintain EU-resident servers; all data is stored and processed in the United States |
| Safeguards | EU Standard Contractual Clauses (Module Two: controller-to-processor). Postmark's DPA is available in the Postmark dashboard and incorporates the SCCs automatically. |
Scope: Used only for outbound transactional email. Inbound email on athelos.pro is handled separately by Cloudflare Email Routing (see §1.3). Postmark does not process inbound mail for ATHELOS.
Sending domain: noreply@athelos.pro, authenticated via DKIM and Return-Path records configured in Postmark and DNS records set at Cloudflare.
2. Change mechanism
2.1 Adding a new sub-processor
ZERODIN may add a new sub-processor by:
- Updating this document with the new vendor's details
- Bumping the version tag (e.g.,
subprocessors-2026-10→subprocessors-2027-01) - Notifying affected customers by email at least 30 days before the new sub-processor begins processing data
- Providing a mechanism for customers to object (see §2.2)
2.2 Customer right to object
If a customer objects to a new sub-processor, they may:
- Terminate the DPA and receive a pro-rata refund of prepaid fees, OR
- Request a migration to an alternative sub-processor, if ZERODIN offers one
ZERODIN will respond to objections within 15 days.
2.3 Replacing a sub-processor
Replacing a sub-processor with another vendor serving the same function is treated as adding a new sub-processor — same notice period, same objection rights.
2.4 Removing a sub-processor
Removing a sub-processor takes effect immediately upon update of this document.
3. Verification
The customer may request confirmation that a sub-processor remains engaged by contacting privacy@athelos.pro. ZERODIN will respond within 15 days.
4. What is NOT a sub-processor
- The customer — always the data controller
- ZERODIN itself — the processor
- The customer's own third-party services — the customer may integrate other tools with ATHELOS; those are the customer's own sub-processors, not ZERODIN's
5. Binding agreement
This sub-processor list is an annex to the DPA. It does not grant rights beyond those in the DPA. In case of conflict between this list and the DPA, the DPA prevails.
6. Version history
| Version | Date | Change |
|---|---|---|
subprocessors-2026-10 | 2026-10-19 | Initial list — Hetzner, Backblaze, Cloudflare, Stripe authorized. SMTP provider TBD. |
subprocessors-2026-10-r2 | 2026-10-20 | Postmark (ActiveCampaign, LLC) added as SMTP provider. TBD removed. |
7. Contact
- Privacy contact:
privacy@athelos.pro - Security contact:
security@athelos.pro